Authentication, Authorization, and Accounting
20 7705 SAR OS System Management Guide
If any RADIUS server rejects the authentication request, it sends an access reject message to
the router. In this case, no access request is issued to any other RADIUS servers. However,
if other authentication methods such as TACACS+ and/or local are configured, then these
methods are attempted. If no other authentication methods are configured, or all methods
reject the authentication request, then access is denied.
The user login is successful when the RADIUS server accepts the authentication request and
responds to the router with an access accept message.
Implementing authentication without authorization for the 7705 SAR does not require the
configuration of VSAs (Vendor Specific Attributes) on the RADIUS server. However, users,
user access permissions, and command authorization profiles must be configured on each
router.
Any combination of these authentication methods can be configured to control network
access from a 7705 SAR router:
• Local Authentication
• RADIUS Authentication
• TACACS+ Authentication
Local Authentication
Local authentication uses user names and passwords configured on the router to authenticate
login attempts. The user names and passwords are local to each router, not to user profiles.
By default, local authentication is enabled. When one or more of the other security methods
are enabled, local authentication is disabled. Local authentication is restored when the other
authentication methods are disabled. Local authentication is attempted if the other
authentication methods fail and local is included in the authentication order password
parameters.
Locally, you can configure user names and password management information. This is
referred to as local authentication. Remote security servers such as RADIUS or TACACS+
are not enabled.
To Next Page
Loading...
